Privacy Policy

Last updated: June 9, 2026  ·  Effective: June 9, 2026

ConvoSurge ("we", "our", "us") is a product of Rockshaft Media. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at convosurge.com.

1. Information We Collect

• Account data: Name, email address, password (hashed), and role when you register.
• Business data: Facebook Page tokens, Instagram Business account IDs, and WhatsApp Business credentials you connect via OAuth.
• Conversation data: Messages exchanged between your business and end-users on connected platforms.
• Usage data: Log data, IP addresses, browser type, pages visited, and time spent on features.
• Payment data: Billing information processed by third-party payment processors (Razorpay). We do not store raw card numbers.

2. How We Use Your Information

• To provide, operate, and maintain the ConvoSurge platform.
• To process and route messages on your behalf via connected channels.
• To send transactional emails (verification, password reset, billing).
• To analyse usage patterns and improve platform performance.
• To comply with legal obligations and enforce our Terms of Service.

3. Data Sharing

We do not sell your personal data. We share data only with:

• Meta Platforms: To send/receive messages on Instagram, Facebook, and WhatsApp on your behalf.
• Supabase: Our database and authentication provider.
• OpenAI: For AI-generated responses (message content is sent to OpenAI API).
• Resend: For transactional email delivery.
• Redis Cloud: For queue and session management.

4. Data Retention

We retain conversation data for as long as your account is active. Upon account deletion, personal data is deleted within 30 days. Anonymised analytics data may be retained indefinitely.

5. Security

Access tokens are encrypted using AES-256-CBC before storage. All connections use HTTPS/TLS. We implement rate limiting and anomaly detection on all API endpoints.

6. Your Rights

You have the right to access, rectify, or delete your personal data. Submit requests to business@rockshaft.org. We will respond within 30 days.

7. Cookies

We use session cookies for authentication. No third-party advertising cookies are used.

8. Children's Privacy

ConvoSurge is not directed at children under 13. We do not knowingly collect data from minors.

9. Changes to This Policy

We may update this policy periodically. We will notify registered users via email of material changes.

10. Contact

Questions? Email us at business@rockshaft.org